Vulnerabilities in IP Protocols

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Vulnerabilities in
Network Protocols

Outline
• TCP/IP Layering
• Names and Addresses
• Security Considerations for
– Address Resolution Protocol
– Internet Pro...

TCP/IP Layering

An Example

Encapsulation

Demultiplexing

Names and Addresses

IP Addresses
• Just to refresh!
• Every interface has a unique IP address
• 32 bits long, usually given in dotted decimal
...

Subnet Addressing
• CIDR - classless Internet domain
routing
• Host ID portion is divided into a
subnet ID and a host ID
•...

Hardware (MAC) Addresses
• Every interface has a unique and fixed
hardware address too
• Used by the data link layer
• In ...

Host Names
• Human readable, hierarchical names,
such as www.case.edu.pk
• Every host may have several names
• Mapping bet...

Address Resolution Protocol

ARP – Address Resolution
Protocol

ARP Spoofing

ARP Spoofing Prevention ?
• Cryptographic protection on the data is
the only way
– Not allow any untrusted node to read th...

Internet Protocol

IP – Internet Protocol
• Provides an unreliable, connectionless datagram
delivery service to the upper layers
• Its main f...

IP Security Problems
• User data in IP packets is not protected in any
way
– Anyone who has access to a router can read an...

IP Security Problems
• Information exchanged between routers to
maintain their routing tables is not
authenticated
– Corre...

Transmission Control
Protocol

TCP – Transmission Control
Protocol
• Provides a connection oriented, reliable,
byte stream service to the upper layers
• ...

TCP- Reliability
• Positive acknowledgement scheme
(unacknowledged bytes are retransmitted
after a timeout)
• Checksum on ...

TCP Connection
Establishment

TCP Sequence Numbers
• TCP uses ISN (Initial Sequence Number)
to order the incoming packets for a
connection
• Sequence nu...

TCP SYN Attack
• An attacker can impersonate a trusted
host
(e.g., in case of r commands, authentication
is
based on sourc...

TCP SYN Attack
• In Berkeley implementations, the ISN is
incremented by a constant amount
– 128,000 once per second, and
–...

Launching a SYN Attack
• The attacker first establishes a valid
connection with the target to know its
ISN.
• Next it impe...

Launching a SYN Attack

What about the ACK for T?
• If the ACK is received by the trusted host T
– It will reject it, as no request for a connecti...

TCP SYN Attack – How to
Guess ISNS?
– ISNS’ (Attacker’s ISN) depends on ISNS and
Δt
– Δt can be estimated from the round t...

TCP SYN Attack – How to
Guess ISNS?
• Attacker has an uncertainty of 1280
in the possible value for ISNS’
• Assume each tr...

How to Prevent it?
• Can be prevented by properly
configuring the firewall
– Do not allow any communication from
outside u...

TCP SYN Flood
• Attacker’s goal is to
overwhelm the
destination machine
with SYN packets
with spoofed IP
• This results in...

How to Avoid TCP SYN Flood
• Decrease the wait time for half open
connection
• Do not store the connection information
• U...

TCP Congestion Control
• If packets are lost, assume congestion
– Reduce transmission rate by half, repeat
– If loss stops...

TCP Congestion Control-
Competition
• Amiable source A yields to boisterous
source B
– Both senders experience packet loss...

DoS-Denial of Service
Attacks
• Attempts to prevent the victim from being
able to establish connections
• Accomplished by ...

FTP – File Transfer Protocol

FTP – File Transfer Protocol
• Typical FTP commands:
– RETR filename – retrieve (get) a file from the server
– STOR filena...

Problems with FTP
• FTP information exchange is in clear text
– The attacker can easily eavesdrop and get the
secret infor...

FTP Bounce Scans
• FTP has a feature to open connection with victim
machine on the request from attacker machine
• Machine...

SMTP – Simple Mail
Transfer Protocol

SMTP Security Problems
• SMTP does not provide any protection of e-mail
messages
– Messages can be read and modified by an...

Domain Name Server

DNS – Domain Name Server
• The DNS is a distributed database that provides
mapping between hostnames and IP addresses
• Th...

Domain Name Server
• Usually (not always) a name server knows
the IP address of the top level name
servers
• If a domain c...

DNS – Domain Name Server
(hostname, IP address) mappings (Resource
Records)
– Received information is cached by the name
s...

DNS spoofing
• The cache of a DNS name server is
poisoned with false information
• How to do it?
– Assume that the attacke...

DNS Spoofing - Approach 1
• Attacker submits a DNS query
“www.anything.com.pk=?” to
ns.victim.com.pk
• A bit later it forg...

DNS Spoofing – Approach 2
• Attacker has access to ns.attacker.com.pk
– The attacker modifies its local name server
such t...

Browser Side Risks

Web Security – Browser
Side Risks
• Obtaining a valid browser
– IE usually comes with the OS
– Netscape can be obtained fr...

Web Forms
• Used to send data from the user to the
server (e.g., online applications, queries to a
database, etc.)
• If pu...

Helper Applications
• The browser cannot handle all kind of
downloaded data
• It invokes an external program (the helper)
...

Cookies
• A cookie is a (name, value) pair
• Cookies are set by web servers and stored by
web browsers
• A cookie set by a...

Cookies: Example
• If cookies are sent in clear, then they can be
eavesdropped and used to hijack an “HTTP
session”
• Cook...

Server Side Risks

Web Security – Server Side
Risks
• Interactive web sites are based on forms and
scripts
– Forms are written in html
– The ...

Unexpected User Input
• Unexpected user input may have
unexpected effects
– Special characters
– Too much data (may cause ...

Buffer Overflow Attacks
• If the program doesn’t verify that the supplied
data fits in the allocated space, then it may
ov...

Cross Site Scripting
• Attacker arranges that the victim receives a
malicious script from a trusted server
• Example:
– Us...

What Will Happen?
• Alice clicks on the link
• HTTP request is sent to trusted.server.com
• Server returns the usual error...

Conclusion
• There are many more vulnerabilities and attacks
• Some of these cannot be prevented by technical means, but
o...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

Report on TCP vulnerabilities by Prakhar Bansal 3000 views
1ip Tunneling And Vpn Technologies ... by Hussein Elmenshawy 1159 views
Ip tunnelling and_vpn by Rajesh Porwal 751 views
Gre tunnel pdf by Rajesh Porwal 1375 views
Tcp sockets by babak danyal 1699 views
Controlling remote pc using mobile by Archana Maharjan 10090 views

View on Slideshare

1 of 64 Ad

View on Slideshare

1 of 64 Ad